U.S. District Judge William Orrick sentenced Sullivan to a few years of probation, noting his important previous work in defending folks from the form of crime he later hid. He additionally mentioned that Sullivan’s steps had succeeded in preserving the stolen knowledge from being uncovered.
Orrick mentioned he felt former Uber chief govt Travis Kalanick was equally accountable for what he thought-about a critical offense, and he questioned aloud why Kalanick had not been charged. The decide additionally mentioned he was influenced by the unprecedented nature of the case, warning that future offenders can be jailed, even when they had been the pope.
Sullivan’s conviction had shocked many safety professionals, a lot of whom noticed Sullivan, a onetime federal cybercrime prosecutor, as an trade chief who additionally labored within the public curiosity as the highest safety govt at Facebook, Uber and Cloudflare.
They additionally criticized the federal government for criminalizing questionable judgment in paying off extortionists when the apply has change into an everyday incidence at U.S. corporations hit by ransomware. The FBI has mentioned it won’t pursue prices towards those that approve payouts that don’t go to gangs underneath sanctions for working in live performance with Russian authorities or concentrating on vital infrastructure.
More than 180 letters had been filed with the decide praising Sullivan and asking that he be spared jail time to proceed serving to defenders and victims of safety failures. One of the letters was signed by 40 present or former chief safety or chief data safety officers.
But prosecutors sought 15 months in jail, arguing that so many individuals rallied to help Sullivan as a result of he was rich and well-connected, and that justice required such defendants be handled the identical manner as poor outcasts.
Sullivan “has a spotless history. He is respected in his community. He is an innovator in his field,” the U.S. legal professional’s workplace in San Francisco wrote in a sentencing memo. “But, when given the opportunity to choose between himself and adherence to the law, he chose himself. Worse than that, Defendant Sullivan prioritized his and Uber’s interests over those of the tens of millions of Uber users and riders who trusted their personal information to the company.”
Both sides mentioned their favored consequence would assist solidify cooperation between U.S. officers and personal safety efforts, a precedence for the Biden administration as legal hacking will get extra refined and extra intertwined with international authorities pursuits.
Kiersten Todt, who just lately stepped down as chief of workers on the federal Cybersecurity and Infrastructure Security Agency, wrote to the decide that high executives had warned her that the decision would “make it impossible to recruit smart people into the roles of CISOs and CSOs if imprisonment is on the table — and will set the industry back.”
From the bench, Orrick mentioned that letters through which different safety executives mentioned they too feared prosecution confirmed that the writers didn’t perceive the info of the case. He mentioned Sullivan intentionally deceived the federal government, inflicting actual hurt to the FTC and the general public.
Speaking briefly and emotionally earlier than the decide pronounced the sentence, Sullivan took duty and apologized for hurting his household, associates and the “noble profession” of cybersecurity.
“I was a bad role model,” Sullivan mentioned in a halting voice. “We’re there to be the champion of the customer, and I failed in this case.”
Citing the letters in their very own memo, Sullivan’s attorneys recounted quite a few good deeds, equivalent to establishing eBay’s belief and security group and a Facebook child-safety effort that his successor there, Alex Stamos, credited with delivering three-fourths of all notifications to the National Center for Missing and Exploited Children in 2021.
“It is not unreasonable to say that Joe and the handful of other executives who tackled this problem in those early days are likely responsible for more global prosecutions of child sexual exploitation than pretty much any other living people,” wrote Stamos, now director of the Stanford Internet Observatory.
The legal case towards Sullivan began when a hacker emailed Uber anonymously and described a safety lapse that allowed him and a accomplice to obtain knowledge from one of many firm’s Amazon repositories.
It emerged that that they had used a stray digital key Uber had left uncovered to get into the Amazon account, the place they discovered and extracted an unencrypted backup of knowledge on greater than 50 million Uber riders and 600,000 drivers.
Sullivan’s group steered them towards Uber’s bounty program and famous that the highest payout underneath it was $10,000. The hackers mentioned they would want six figures and threatened to launch the information.
Negotiation ended with a $100,000 fee and a promise from the hackers that that they had destroyed the information and wouldn’t disclose what that they had accomplished. While prosecutors referred to as it a coverup, testimony confirmed that Sullivan’s workers used the method to get clues that will make them the true identities of the perpetrators, which they felt was needed leverage to carry them to their phrase. The two had been later arrested and pleaded responsible to hacking prices, and one testified for the prosecution in Sullivan’s trial.
The obstruction cost drew energy from the truth that Uber on the time was nearing the top of an FTC investigation following a significant 2014 breach, which occurred earlier than Sullivan joined the corporate.
While he directed the response to the 2 hackers, Sullivan saved many others on the firm apprised, together with a lawyer on Sullivan’s group, Craig Clark. Evidence confirmed that Sullivan advised Kalanick, Uber’s CEO on the time, and that Kalanick accepted Sullivan’s technique. The firm’s chief privateness lawyer, who was overseeing the response to the FTC, was knowledgeable, and the pinnacle of the corporate’s communications group additionally had particulars.
Clark, the designated authorized lead on breaches, was given immunity to testify towards his former boss. On cross-examination, he acknowledged advising the group that the assault wouldn’t must be disclosed if the hackers had been recognized, agreed to delete what that they had taken and will persuade the corporate that that they had not unfold the information additional, all of which ultimately got here to move.
Prosecutors had been left to problem “whether Joe Sullivan could have possibly believed that,” as considered one of them put it in closing arguments. In his remarks Thursday, Sullivan mentioned he ought to have gotten an out of doors authorized opinion as a substitute of being relieved at getting inner cowl to keep away from disclosure.
After Kalanick was pressured out of the corporate for unrelated scandals, his successor, Dara Khosrowshahi, got here in and discovered of the breach. Sullivan described it as a routine bug bounty payout, prosecutors mentioned, enhancing from one e mail the quantity of the payoff and the truth that the hackers had obtained unencrypted knowledge, together with cellphone numbers, on tens of tens of millions of riders. After a later investigation turned up the complete story, Khosrowshahi testified, he fired Sullivan for not telling him extra, sooner.
Eager to point out that it was working in a brand new period, the corporate helped the U.S. legal professional’s workplace construct a case towards Sullivan. And the prosecutors in flip unsuccessfully pressed Sullivan to implicate Kalanick, who would have been a far larger prize however was not damned by the surviving written proof, in keeping with folks aware of the method.